Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 02:05 UTC

Critical in the last 24 hours

1603 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

144-76% vs 7-day avg of 597

2 critical, 38 high, 59 medium, 25 low

Expand	Severity	Score	Advisory	Title	Source	Flags	Published
	Low	2.1	CVE-2026-116103	A vulnerability was identified in Sony Neural Network Libraries up to 1.39.0 SonySony Neural Network Libraries, Sony Neural Network Libraries (nnabla)	NVD		Oct 26 01:17 UTC
CVE-2026-116103A vulnerability was identified in Sony Neural Network Libraries up to 1.39.0 Executive summary Sony Neural Network Libraries (nnabla) up to and including v1.39.0 contains a code injection flaw in its command-line parameter encoder. An attacker who supplies a malicious parameter directory can run arbitrary operating system commands when a victim runs the documented encode_param command, and the advisory says this happens without any visible error. The advisory rates the issue High under CVSS v3.1 with a score of 8.8, and states that the project is end-of-life so no upstream patch is expected, with the workaround being to avoid processing parameter directories from untrusted sources. Technical summary The flaw is CWE-95 eval injection: the first line of each .txt parameter file is passed to Python's eval() without validation in load_param_in_txt() in encode_decode_param.py at line 37, reachable through nnabla_cli encode_param. Exploitation requires the victim to run the command on an attacker-supplied directory (CVSS AV:N, PR:N, UI:R, AC:L), and the advisory's proof of concept shows the canary command completing with exit code 0. Affected versions are stated as all versions up to and including v1.39.0, and the advisory says vulnerable code remains on the master branch; no fixed version is stated because the project is end-of-life and no upstream patch is expected. The suggested remediation is to replace eval() with ast.literal_eval() plus integer validation, and the stated workaround is to never run encode_param or decode_param on untrusted directories. The advisory gives no detection guidance beyond the proof of concept, and it does not state whether exploitation has been observed in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/3em0/cve_repo/blob/main/2026…)-Code-Injection-in-'nnabla_cli%20encode_param'-Leading-to-Arbitrary-Command-Execution.md Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Sony Sony Neural Network Libraries Sony Neural Network Libraries (nnabla) NIST National Vulnerability DatabasePublished Oct 26, 2026 01:17 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Search syntax

Welcome to CVEsee.org

What is CVEsee.org?

Disclaimer

You are leaving CVEsee.org

Install CVEsee